User Perspective: How to Avoid Governance Attack Risks During Downturns in the Crypto Market
The upcoming governance attack is likely to far exceed the previous bear market. During the market's "garbage time," it is recommended that users adjust their positions and on-chain interaction methods as early as possible to reduce risk.Author: K Ericak
The current market situation resembles a condensed version of the fusion between 2019 and 2022, with various issues erupting together, making it as challenging as a hell-level dungeon.
Compared to 2019, it does feel quite similar, but it lacks the dreamlike atmosphere that some friends had back then, proclaiming that the DeFi era was about to arrive; the overall feeling is much worse.
The external environment is shifting from virtual to real, while inside the market, there are only small hotspots without major trends. Essentially, it is still based on limited liquidity within the market, but with a massive fragmentation of liquidity across various ecosystems.
Every specific ecosystem that forcibly creates a local mini bull market feels like a smaller version of the $trump effect; each small hotspot is seen by many as another opportunity to escape.
Compared to 2022, it feels like taking the dregs and leaving the essence.
There are many uncertainties, but at least one thing is certain:
Next, there should be governance attacks that far exceed those of the last bear market ------ during the market's garbage time, it is best to make some adjustments to positions and on-chain interactions based on this.
What is a Governance Attack?
A governance attack refers to an attacker exploiting vulnerabilities in the governance mechanism or capital advantages to influence project decisions for personal gain or to disrupt the system. This usually occurs during periods when governance token prices are depressed and market liquidity is exhausted, allowing attackers to control decision-making at a low cost.
In the last bear market, the most common scenario was:
Many protocols' governance tokens (or NFTs) were ignored and continuously declined, yet the treasury still held significant assets. When a clear imbalance arises between the two, creating an arbitrage opportunity, ill-intentioned individuals will appear.
Attackers typically accumulate governance tokens in large quantities at very low prices during deep bear markets (this is more common with smaller protocols), or they may temporarily borrow governance tokens in large amounts through flash loans to execute direct on-chain voting.
The purposes of the attack are usually twofold: to steal funds and to alter contract logic.
For example, directly transferring all assets from the treasury could lead to some small projects that could have survived the bear market being unable to continue, causing the value of the governance tokens you hold to naturally decline, and the entire project could even perish.
For instance, in some full-chain governance projects with a Proxy mechanism, once the governance attacker seizes control, maliciously rewriting contract logic, if you happened to authorize some assets during a bull market, those assets would be at risk, especially stablecoin assets.
A brief explanation: Proxy allows protocols to update contract logic without changing the original contract address. This is common in DeFi, but if governance rights are seized by an attacker, they can modify the Proxy to execute malicious logic, such as transferring assets or altering trading rules.
The most common scenario is when you interact with some DeFi protocols, you usually authorize assets like USDC, USDT, DAI, and if you haven't manually revoked those authorizations, during a market downturn, if such a situation arises and you still have these assets in your address, the modified malicious contract logic could directly transfer all your USDC, USDT, and DAI away.
In the crypto space during a market downturn, as most people's attention dissipates, it can easily turn into a dark forest filled with hunters.
I remember in the last bear market, even when some small protocols had only a few tens of thousands of U in arbitrage space, there were still people willing to ambush, ultimately realizing governance attacks that completely destroyed the protocol.
In this cycle's downward phase, aside from governance attacks from external attackers, in an atmosphere of crumbling trust, some project teams may also exploit their voting advantages to rob the community, with the most common behavior being the arbitrary issuance of tokens.
From the holder's perspective, holding a large amount of tokens while ignoring governance changes can easily lead to significant losses.
A recent case is the governance proposal issued by CRO in early March, Governance Proposal.
Claiming to herald the "New Golden Age of Cronos," it suddenly printed an additional 70 billion on top of the original total supply of 30 billion, which was unlikely to pass, but ultimately due to the official's personal intervention to vote YES, this bizarre proposal narrowly passed two days ago.
Subsequently, the project team issued a proposal to burn 50M $CRO as a gesture, which is quite absurd.
(Remember when we discussed arbitrage based on governance information asymmetry, mentioning the project team issuing more tokens to go public on Binance, and how researchers could arbitrage? The current market stage and environment have changed; if you see token issuance, it is very hard to think positively. Instead, you need to consider other factors to deduce why this is happening, what kind of team it is, and whether they are genuinely considering the community. I believe everyone has their own scale for this.)
How Can Ordinary Users Avoid This?
In daily interactions, avoid long-term, unlimited authorizations for stablecoin assets like USDC: It is recommended to choose a limit each time you authorize, and when GAS fees are low, take some time to check authorizations using tools like revoke.cash to cancel unnecessary ones, while also periodically changing to new addresses;
Screen the projects you participate in, avoiding those with opaque governance mechanisms, especially those with Proxy changes that are unaudited and lack oversight. For some new DeFi projects, force yourself to pay attention to this to avoid a lucky mentality and develop a habit;
For projects with high relevance to your positions, rely on yourself or delegate to other researchers to regularly check DAO governance proposals, promptly noting malicious proposals to unite for counterattacks; for example, @byobu4 and their Protector established during the last bear market did a lot of governance maintenance work.
That's all I can think of for now; I'm recording this. Recently, after discussing with a few whale friends, it seems everyone is quite pessimistic about the future market.
Many friends initially thought that DeFi might still have a glimmer of hope to innovate under loosening U.S. policies, but as mentioned above, the mini bull market that BSC has forcibly created these days can also be seen as another smaller version of the $trump effect. It is still difficult to see the possibility of improved liquidity in the market. If overall liquidity continues to become further fragmented and exhausted, the industry may enter a phase of frequent governance attacks, and it’s hard to say whether it will get worse.
In the grand backdrop of shifting from virtual to real, the absurdity of the virtual world and the decline of bottom lines may just be a rehearsal for an even more absurd reality in the future. Regardless of what the future holds, it is wise to take a step back, prepare for the worst, and avoid some potential risks with a high degree of certainty.
